RFC 35140: HTTP Do-Not-Stab (2023)

https://www.5snb.club/posts/2023/do-not-stab/

by zkldi • 2 years ago

815 207 2 years ago

I’ve always wondered, since an RFC is a request for comment, how does one leave a comment? And who?

vandyswa• 2 years ago

RFC's operate under the IETF. RFC's are developed under some specific group, and you can join that group, the business is generally conducted on email. There are (well, were back when I participated) in-person meetings, but attendance there was not mandatory.

teddyh• 2 years ago

RFC:s are published by the RFC Editor <https://www.rfc-editor.org/>. While it’s true that most RFC:s are written and published through the IETF, this is not an actual rule.

staplung• 2 years ago

A bit of lore that I learned in my networking class in college was that the RFC name was chosen as tongue in cheek in that by the time a proposal gets to the RFC stage, comments are very much not appreciated. You're supposed to comment well before that point.

No idea if that bit of lore is true but it is certainly the case that RFCs are usually the final word on the relevant standard. In fact, once they get their ID, RFCs cannot be modified or rescinded; only superseded by another RFC.

SilasX6• 2 years ago

Then they should be renamed CFCs (closed for comments).

jaza2• 2 years ago

Finally I understand why RFCs are served with the Do-Not-Comment header!

dogleash• 2 years ago

That's apocryphal, the name just lasted beyond the original workflow of a now 55 year old publishing system.

The idea that a published RFC is a final word is a newer idea too. Yeah, you can't modify an RFC, you have to publish a newer one, but that was a pretty good way of doing distributed change control in 1969.

riffic• 2 years ago

"request for compliance" is the alternative interpretation.

jowea• 2 years ago

The early RFCs were, in fact, requests for comments on ideas and proposals; the goal was to start conversations rather than to create an archival record of a standard or best practice. This goal changed over time, as the formality of the publication process evolved and the community consuming the material grew. Today, over 8500 RFCs have been published, ranging across best practice guidance, experimental protocols, informational material, and, of course, Internet standards.
https://www.rfc-editor.org/rfc/rfc8700.html

Nowadays you're supposed to comment before it gets to "Internet standard"

layer82• 2 years ago

You can submit errata. Maybe it should be renamed to RFE.

actionfromafar• 2 years ago

This is such transparent EU Bureaucracy shilling. No wonder Europe doesn't have any large SaaS companies with their stabbing unfriendly business climate.

nyanpasu64• 2 years ago

I downvoted before I read the end of the comment and realized this was satire.

bue7jclotemp• 2 years ago

I think you are factually wrong: Skype, Spotify, Revolut, Zendesk, Transferwise... There are quite many European unicorns too (less though than US and Chinese companies) which are operating as SaaS. Some of them got acquired or re-based to other countries though

notpushkin2• 2 years ago

Can confirm, got stabbed by a spammer on Skype yesterday.

hmottestad• 2 years ago

Didn’t Zendesk stab a pentester recently?

https://news.ycombinator.com/item?id=41818459

MBCook• 2 years ago

Good to know HN will be the same in 100 years. /s

phoronixrly• 2 years ago

Yeah, why can't the EU just leave the stabtech industry stab in peace?...

rurban2• 2 years ago

The stabtech industry will just change to Stab-Into-The-Back technology, because every user hates to be stabbed in the chest, but doesn't care if it's not seen.

cuuupid• 2 years ago

For the low price of $20/1000 clicks, I will provide you with a stabbing consent banner, fully compliant with upcoming EU and CA regulations on web-based stabbing.

jsheard• 2 years ago

I'm sold, the distinctions between "necessary", "targeting", "performance" and "functional" stabbings are such a minefield. Not to mention how I'm supposed to properly disclose the 846 different stabbing brokers I work with. How's a man supposed to make a living stabbing people with all of this red tape in the way?

makapuf• 2 years ago

At least people will be able to differentiate between legitimate interest to stab you and consent to be stabbed for 247 of those 846 partners.

Macha2• 2 years ago

By the way, studies show users only opt in to stabbing with our competitors banner 95% of the time, but they opt in with ours 98% of the time, thanks to our banner taking 50% longer to properly opt out of, so you should really go with us.

layer82• 2 years ago

I raise you 5000% longer, which gets you to four nines.

tdeck• 2 years ago

For those who only skim things, it might be worth scrolling down to read the "Editor Comments" section which is the actual article.

MathMonkeyMan• 2 years ago

I feel like that section ruins the joke.

SilasX6• 2 years ago

Maybe it’s just me, but I fundamentally disagree with the mentality that we should prioritize the “feeling of being special” among those who already get the joke (and corresponding point) at the expense of those who have yet to appreciate the message.

You can still laugh at the joke with the section there, you’ll just have fewer confused people to correct, and be in one less elite club.

grahamj2• 2 years ago

I bailed before that so thanks for pointing it out. I couldn't agree more, both with the point implied by the RFC and with that directly stated below.

Timwi• 2 years ago

I feel the need to comment on one sentence in it: “companies are god damn children and must be told no explicitly by every person individually.”

While it's true that children will often go out of their ways to test boundaries, I have no trouble giving them the benefit of the doubt and saying that children are innocently experimenting.

Companies, meanwhile, are doing this with fully deliberate malicious intent. They do this because capitalism rewards it. We need to say this, and keep saying it, until everyone gets it. Companies cannot be reared like children. Companies do not “mature” to become well-behaving, ethical citizens. With the profit motive in effect, companies have every incentive to work around every legislation and regulation and screw us at every opportunity they get. The profit motive must go.

TacticalCoder• 2 years ago

it’s fucking depressing when even the fucking bare minimum form of regulation is followed to the letter and no more, because every company out there fucking hates you and would sell you out to make a bit more money if they legally could. and even if they couldn’t, who’s going to stop them?

Certainly not any government. If you think the EU's regulation are of any help to the consumer you are gravely mistaken. The EU is quickly becoming a fucking nightmare to live in. "The more corrupt the state, the more numerous the laws". The meme that goes around atm is that while Elon Musk created Tesla, SpaceX and Starlink the EU managed to get everybody to now have plastic bottles who do not close properly anymore: due to some regulation that mandates that bottle caps must hold to the bottle, weird only partially-functional mechanism have been created and it's a PITA to either drink from a plastic bottle or, worse, try to lay it horizontally in a fridge.

That's what the EU is: probably that some politicians or bureaucrats with enough brain cells to recognize a bottle cap on the ground thought "I've got an idea to make the EU better, let's mandate every bottle to have a cap that cannot be separated from the bottle".

As a result you lay horizontally a plastic bottle of sugary drink in your fridge (because you've been used to do that for decades) and now all your fridge is sticky due to the bottle leaking.

It's all that is wrong with the EU bureaucrats in one example.

Also hailing the EU as the savior vs Microsoft when our lives becames miserable with EU consent cookie popups virtually everywhere is a bit thick.

orbat2• 2 years ago

So the EU is bad because you can't learn to screw on a bottle cap that's different than before?

lmm3• 2 years ago

Honestly yeah. The EU is run entirely by PMC people who don't understand or care about the effect on lower-class and frankly less intelligent people's lives.

SirHumphrey• 2 years ago

I am not joining the whole “EU is bad argument”, however the new caps are very annoying, especially the limited benefits they provide.

CRConrad• 2 years ago

The meme that goes around atm is that while Elon Musk created Tesla, SpaceX and Starlink the EU managed to get everybody to now have plastic bottles who do not close properly anymore: due to some regulation that mandates that bottle caps must hold to the bottle, weird only partially-functional mechanism have been created and it's a PITA to either drink from a plastic bottle or, worse, try to lay it horizontally in a fridge.

I haven't encountered that meme, but if it exists, it's like most memes seem to be: Wrong. The bottle caps work just fine.

rakoo3• 2 years ago

while Elon Musk created Tesla, SpaceX and Starlink the EU [created] some regulation that mandates that bottle caps must hold to the bottle

At least the EU made something useful

nojs• 2 years ago

Wouldn’t this header just be another bit of entropy used by companies that are going to stab you anyway?

wkat42424• 2 years ago

Without legal backing, yes. If it had that it would have been a very different story.

sionisrecur• 2 years ago

If you make misusing the header illegal then only illegals will stab you.

SilasX6• 2 years ago

I couldn’t tell if it was intended to be a note-for-note parody of an RFC about the do-not-track header, but I couldn’t find one that would qualify. The closest would be this[1], but it doesn’t cleanly match up (in part because [1] is more verbose and its points scattered).

Another satire RFC in the same spirit is the one about the evil bit[2] (designate one bit in packets to indicate whether it’s intended for evil), with the same subtext as the linked post: no, you can’t trust malicious entities to change their behavior to make it easier to stop.

[1] https://www.w3.org/TR/2019/NOTE-tracking-dnt-20190117/

[2] https://datatracker.ietf.org/doc/html/rfc3514

foundry27• 2 years ago

It’s great satire, but it really does mirror a larger societal shift where the burden of safeguarding personal autonomy has shifted from institutions/regulators to individual users. Do-Not-Stab, Do-Not-Track, whatever it might be, any sort of “voluntary compliance” is a non-starter in the face of financial pressures

IMO we need to start normalizing being militant about this stuff again, to aggressively and adversarially defend the freedom to use your computer the way you choose to use it

mpalmer• 2 years ago

To be extremely pedantic, it's great satire precisely because it mirrors that shift. Owes a lot to the OG, A Modest Proposal.

thrtythreeforty• 2 years ago

I'm registering my elderly relatives for dmachoice.org, to prevent them from getting junk mail. These clowns create the problem and then have the audacity to charge you to be added to the opt out list. I was really skeptical about the GDPR when it was passed and I am now fully on board for an American version.

shadowgovt12• 2 years ago

I'm still extremely skeptical of it because in practice it basically added a cookie banner to every every website I visit infrequently with no particular benefit to me.

I'm just going to click "yes," stop asking.

shadowgovt12• 2 years ago

On the internet, it started as the user's responsibility.

For netizens, the idea that the use should be able to opt out of logs about their interaction with the service the operator owns is novel (because they always had the option of not using the service if they found the pattern distasteful).

blooalien3• 2 years ago

There's a bit of a difference between normal logging of access to services to protect your devices / network (and to understand your users' access to your services), and using every nasty trick in the book to build extensive detailed profiles of everyone's browsing footprint across the entire web, often without their knowledge or consent (hence the laws, because it's the only way to convince some folks to not do bad things). The first should be expected behavior, whereas the second should be considered unacceptable and abusive, but has somehow been "normalized" in modern society.

wkat42424• 2 years ago

Yeah and the fuss about it being enabled by default is not really relevant. In the EU tracking must be opt-in anyway. So this is expected behaviour.

However the EU dropped the ball by not making it mandatory to respect this flag. If they had we wouldn't have had the huge cookiewall mess we have now.

Deukhoofd• 2 years ago

The annoying thing is that they have regulations in trilogue that would actually make the DNT header obligatory to follow, the ePrivacy Regulation. That was supposed to drop alongside GDPR, but has instead been delayed for 6 years now. It's apparently supposed to be finally finalized somewhere in 2024, so I hope to see it sometime soon.

IgorPartola• 2 years ago

I wonder if there is some way to DoS the tracking services by basically accepting third party cookies but then immediately discarding them so every page load generates a new cookie and presumably state stored on the other end to match it. Or are these tracking cookies typically self-contained so that no state is stored server-side?

tliltocatl• 2 years ago

Given that web industry uses no-server-state for *authentication* (with all the issues it implies), i would expect tracking also be no-server-state.

rixed• 2 years ago

Isn't that the reason cookies were invented in the first place? To keep servers stateless?

aaronbrethorst• 2 years ago

Best time to do that would've been 19 days ago, but here we are. Buckle up.

photonthug• 2 years ago

aggressively and adversarially defend the freedom to use your computer the way you choose to use it

Sadly even if you’re inclined to do this, it’s always a war of attrition, and corporations seem to realize they can just up the cost of your resistance in terms of time/frustration, and that’s enough for them to win in the long term. The history and trajectory of platforms, from browsers to AppStore’s to SaaS-all-the-things, is just tragic, with the amount of user control on a downward slide at each stage. The big question now is whether / how / to what extent AI is going to be corporate or democratized, but it’s hard to be optimistic.

Or, you know, if Clicking do-not-stab for 60 more years sounds like it sucks, you can try to become a shepherd or something. Works great for ~10 years, and then you can’t use cars, dishwashers or light switches without clicking do-not-stab, at which point they finally win and you say, you know what? I should be grateful they asked before they stabbed me, I practically owe it to them anyway, and I can’t wait to see all the love/cash rolling in after I’m a big shot shepherd influencer. Like and subscribe y’all and as always, hail corporate

mcdeltat• 2 years ago

Worth noting the times where you have the choice to engage or not with a company with bad practices. Make it unprofitable for them to provide horrible service. Particularly applicable to tech, because most of it is useless rubbish we don't really need anyway!

travisgriggs• 2 years ago

Is this a case where monopoly actually benefits the cause? The last great uprising in the public interest, imo, was Microsoft against the open source movements at the turn of the century. It was a heady time to be involved in software. I miss it frankly.

But perhaps it really only succeeded, because that Microsoft was like the Boeing of today, a company where Pournelles second type (the institutionalists) had taken over and was just riding out the momentum, allowing the upstart unfunded open source hippies to actually have success.

tbrownaw2• 2 years ago

larger societal shift where the burden of safeguarding personal autonomy has shifted from institutions/regulators to individual users.

If anything the shift is going the other way, with some of the more busy-body jurisdictions trying to take things that are properly enforced by the user's user-agent and instead making them officially the responsibility of the other party.

klabb3• 2 years ago

IMO we need to start normalizing being militant about this stuff again, to aggressively and adversarially defend the freedom to use your computer the way you choose to use it

Yes. As a millennial the times of civil disobedience was better. Not only did we get a better internet for consumers, but better companies were rewarded and won. Rose tinted glasses? Possibly, but there’s another reason for disobedience: the other side does it, and they do it just for money.

Concretely, is there something like Adblock that can be done for cookies? I don’t think blocking is as effective as poisoned data though. They ask for data, they should get it. If you don’t get consent, poisoned data is merely malicious compliance.

It could even be standardized as an extension to DNT: “if asking for consent after a DNT header, a UA MAY generate arbitrary synthetic data”.

cjs_ac• 2 years ago

Concretely, is there something like Adblock that can be done for cookies?

I use a combination of two browser extensions: Cookie AutoDelete[0] and I don't care about cookies[1]. The second hides any GDPR 'compliance' popup; the first deletes any cookies set by a website when you close the last tab with it open. Both extensions have whitelist functionality.

[0] https://github.com/Cookie-AutoDelete/Cookie-AutoDelete

[1] https://www.i-dont-care-about-cookies.eu/

rakoo3• 2 years ago

Use ublock origin with the "Cookie notices" custom lists. Not explicitely accepting cookies is legally the same as refusing them (now, whether websites actually respect that is the opening keynote of the Naiveté conference)

pims3• 2 years ago

It's amusing to see this message heavily upvoted on HN when most mentions of Firefox here are welcomed with an avalanche of perfect solution fallacies.

I'm dubious about people becoming militant about this when the software engineering industry gave Chrome a red carpet by using it and installing it on their relatives' computers while knowing very well it's adware and when switching to the alternative is incredibly cheap.

mschuster91• 2 years ago

Chrome had the advantage for a long term because their dev tools were just so much better than Firebug in both features and performance. Even today, I can't pinpoint it to specific things because it's (relatively) little and subtle differences, but Chrome's dev tools feel way more polished than Firefox's.

It's almost as if Steve Ballmer and the legendary "developers developers developers" speech still rings true today - the key to getting people to use your software is to make life as easy for the power users as possible, let them spread the word. And it's ironic how Microsoft lost its ways there... a lot of people I know have gone from Windows to Mac and convinced their close relationships (aka those whose computers they fix) to do the same. It's just so much more relaxing to boot into an OS that doesn't try to shove advertising down your throat at every turn.

imglorp2• 2 years ago

I think we shouldn't minimize the harm Chrome does by calling it adware. It monitors all your activity for Google to tie it to your identity, who then publish your demographics, preferences, history, and mental state on the global markets. Let's call it what it is: a brain tap.

account424• 2 years ago

Mozilla would be the first to request permission to stab you so that they can then analyze the blood of the knife in order to make future product decisions.

latexr3• 2 years ago

It's amusing to see this message heavily upvoted on HN when most mentions of Firefox here are welcomed with an avalanche of perfect solution fallacies.

HN is not a hive mind. There are people here who love Firefox, people who despite it, and everyone in between. It’s tiring to always be reading your type of comment, as if everyone is a hypocrite. Maybe, just maybe, the people making those contradictory comments are not the same individuals.

And it’s not like Mozilla is free from controversies, including several of betraying user trust. If every major browser maker is going to break your trust and sell your data, I can see why people choose their poison based on other factors.

I use neither Firefox nor Chrome. Is Safari any better? Or Brave? In some areas yes, in others no. I don’t think there’s a single browser vendor which gets it unambiguously right.

bagels• 2 years ago

The authors are [redacted] Google. Are they actually Google? They seem to unironically complain about what Microsoft is doing, but Google is guilty of the same.

bhaney• 2 years ago

Dude come on

Mathnerd314• 2 years ago

The actual author is one person, user '5225225'

averageRoyalty2• 2 years ago

Apparently they identify as a robot, not a person.

teractiveodular• 2 years ago

I think the author's entire point is that self-regulation by the big boys is not working very well.

jaza2• 2 years ago

Relax, folks, entities have plenty of other options, there still won't be support for Do-Not-Shoot, Do-Not-Rape, Do-Not-Stone, fun for the whole family.

grahamj2• 2 years ago

Don't forget robots.txt

PeeMcGee• 2 years ago

it’s fucking depressing when even the fucking bare minimum form of regulation is followed to the letter and no more

For Microsoft this also rings true from the opposite direction. Any specification that Microsoft technically abides is implemented in an egregiously dark way (at least for anything consumable at an enterprise level).

They go to great lengths to exercise every bit of leeway permitted by the spec, even when it doesn't make economical sense, because what are you gonna do about it? Vote with your wallet? Against the vendor that runs all your workstations and manages your directories and databases and deployments and authentication and authorization and business intelligence and and and?

No, you're gonna accommodate their absurd counter-requirements because what other choice do you have? The decision then becomes:

1. branch your code to shit with `vendor == microsoft` clauses

2. branch your project/architecture to shit and effectively maintain a Microsoft version alongside the "normal" core version

3. use Microsoft's bespoke library that solves the problem they created

A project that selects option 3 will face the least resistance integrating with Microsoft products, but will also become beholden to arbitrary rules that complicate integration with every other vendor who benevolently implements the standard.

jeroenhd2• 2 years ago

It's important to note that the Do-Not-Stab header has been deprecated because one browser engine switched it on by default and requiring users to opt into stabbing hurt the bottom line of the stabbing industry, so it's no longer respected. Luckily someone came up with General Assault Control, a non-standard alternative, which also only has one value, so you can set Sec-GAC to 1 to request websites not to assault you. By design, this header cannot be extended, so it cannot be used to distinguish brutal stabbings from a comedic pie to the face in the future.

Because of legal requirements, the General Assault Control header may not be enabled by default, as American states like Colorado require explicit opt-out (rather than explicit opt-in). This protects Colorado's thriving stabbing and shooting industry as most users will never want to opt into being stabbed.

Despite the feature being forced to be disabled by default, the organisation behind the spec is pushing hard for customers to download fringe browsers that implement the feature (though you may need about:config to enable it). Because of the small user base, the request not to be assaulted can be used by websites not willing to follow the standard to make their stabbings and shootings more precise. End users can request a JSON file from the web server containing the supposed support for the GAC header, but requesting this URL may be used to kick the user in the teeth by non compliant servers.

boomlinde• 2 years ago

It's now customary, in order to comply with European regulations, to present users with a list of possible violent crimes against their person that they can opt out of before using a website. This ensures that non-consent to stabbing is always an active choice, so that users who want to be stabbed or otherwise maimed won't accidentally miss out on the opportunity.

rakoo3• 2 years ago

We value your body integrity. We and our 1492 partners would like to stab you.

SlightlyLeftPad• 2 years ago

Is this part of a long term plan for opt-in suicide booths in New New York City?

skriticos2• 2 years ago

Why is it a binary value? What about masochists, or people who lost a bet and want to be stabbed just a little? Or strangled?

jnordwick• 2 years ago

You can put a window that covers the bottom half of the content the defaults to all assaults being allowed also has a way to customize which assaults you would like. It shouldn't be possible to uncheck necessary assaults for the website might not work.

dare944• 2 years ago

because every company out there fucking hates you

They don't actually hate you. Rather, they love your money and they have a depraved indifference for you.

dylan6043• 2 years ago

No, they love the money they can make about you. I don’t know anybody giving their money to these people. It is other shady companies buying the data about for, shady companies that have collected. All of this is offered to you free of charge.

notpushkin2• 2 years ago

Mind you, some companies will take your money and still track the shit out of you, show you ads, and sell your data to the highest bidder.

khafra• 2 years ago

They don't hate you, but they're Out To Get You (https://www.lesswrong.com/posts/ENBzEkoyvdakz4w5d/out-to-get...)

forty• 2 years ago

looks like someone just discovered that capitalism is bad for people ^^ who would have thought it...

maufl• 2 years ago

That reminds me of the second half of this sketch https://www.youtube.com/watch?v=uQjUh4nWwaM

tsujamin• 2 years ago

A big shoutout to those reading the comments who are the direct subjects of this satire.

indus• 2 years ago

Why a header?

Do a sidedoor as a /do-not-stab.txt

Do-Not-Stab: 1

m0rissette• 2 years ago

Right. This was just too on point. Thank you for making my night!

andyzei• 2 years ago

The Do Not Track header was originally proposed in 2009 by researchers Christopher Soghoian and Sid Stamm.[2] Mozilla Firefox became the first browser to implement the feature.

https://en.wikipedia.org/wiki/Do_Not_Track#:~:text=The%20Do%....

shdon2• 2 years ago

I wonder how many web developers actually honour Do Not Track. I do, in all the websites I've made for my employer too, but I think I'm only getting away with it because my employer doesn't know. I've even made it so that browsing with Do-Not-Track enabled also skips the cookie consent banner and just assume the user wants no cookies other than the strictly necessary ones (like their session/login cookie), and doesn't include Google Analytics, instead just upping a single view counter on the page, with no PII in there.

kelnos• 2 years ago

A better option would be to just make tracking illegal, and heavily fine companies that are found to be doing it. And make it strict liability, so intent doesn't matter.

I can dream...

jeroenhd2• 2 years ago

You're taking exactly the right approach in my book. Thank you!

I don't know if they still do it, but last time I browsed Medium I found that it claimed to respect DNT, which is quite nice. Lots of self-hosted analytics software also respects DNT out of the box and I don't think site administrators often bother to turn that off. Still, the vast majority of websites probably ignores the header, especially since it's been deprecated as a standard. If you care about such things, maybe also consider looking into Sec-GPC, its intended replacement.

killerstorm• 2 years ago

There was a much more elaborate standard called P3P recommend by w3c in 2002. It apparently defined a description of how business can use personal data.

But apparently it was considered too complex and "lacking enforcement".

Now maybe if it survived till GDPR it could have it's enforcement, but Mozilla yanked support before that...

scotty79• 2 years ago

I'd love for Please-Do-Stab header to exist so I can just set it and with it opt out of any stabbing-anti-stabbing wars and politics.

I fully understand that it's absence wouldn't meant that people won't get stabbed, but it would save time and mental space of all people like me who really don't care about being stabbed or not.

Honestly if anything, I'd like to be stabbed more.

By analogy to current situation about tracking ... Ad companies know too much about me? I think they know too little. For example for half a year they still haven't figured out that I know barely any words in German and are serving me German advertisements all the time just because I happen to be living in Germany currently.

b0rbb• 2 years ago

For some reason, I'm reminded of a particular comic strip from Achewood - https://achewood.com/2007/01/11/title.html.

"Fools! I have invented a usb device which can collect votes from the Internet and drive a knife through your heart!"

tonetegeatinst• 2 years ago

This is going to wipe out the saas market

(Sutures As A Service) which is a additional somewhat often used service once Stabbing As A Service has occurred.

tbrownaw2• 2 years ago

I see someone needs to teach their user-agent how to say "no".

Maybe they could get advice on the best way to do that from these people?: https://news.ycombinator.com/item?id=42169027

benreesman• 2 years ago

Sounds like handlers of the “UPGRADE” verb SHOULD have taken the “WOCK” to Poland.

zatkin• 2 years ago

Well that's one way to take a stab at this problem.

ipnon• 2 years ago

Adtech is kind of like the fungal domain of the web, in that it allows life to technically exist where it shouldn’t, because death is actively in progress. It recycles deathly content back to the top of the food chain to Big N, wherein it is reconstituted into cushy salaries for the people that ultimately create the infrastructure that allows endless slop to permeate the web.

averageRoyalty2• 2 years ago

This website appears to be part of a webring (how delightful!) made up of MtF trans people, furries, self-identified robots (some of which exclusively use third person pronouns) and sometimes a mixture of these. All appear to be some form of sysadmin or programmer.

This isn't my tribe, but I'm incredibly pleased to see a beautiful reflection of the old internet within this webring.

yieldcrv• 2 years ago

“We and our 756 partners process personal data[…]” wow big polycule this website is in

This gets more and more unhinged, I love it

atoav• 2 years ago

If Monty Python made an RFC it would look very much like this one, just with more fruit.

On a more serious note: yeah wtf. I hope we in the EU draw the conclusion of companies even being unable (unwilling?) to gain informed consent and just start treating these privacy breaches as an outright crime.

iddan• 2 years ago

Excellent satire. Really drives the point home. I think it's hard sometimes to understand just how much forces of bad use paper trail to push their agenda. This outlines this really well

hamdrew• 2 years ago

I'm personally more worried about being clamped, but this is a step in the right direction.

dingosity• 2 years ago

   Them: What's your LinkedIn Account?
   Me: Don't have one.
   Them: Twitter?
   Me: Nope.
   Them: InstaGram or TicToc?
   Me: Nope.
   Them: Do you use the web at all?
   Me: Only through Lynx.  I see a lot fewer ads.
   Them: No JavaScript!  How do you use YouTube?
   Me: I don't, really.
   Them: You have no social media?
   Me: Well... I *did* order a pizza from Dominos online once...

   Yeah... I don't use the web much as you would expect for someone
   who's livelihood depends on it.  I just wish USENET was still
   USEFUL.  I have a rant in me about ad-tech and crap-ware on the
   web.  I'm just enjoying my life without the web too much  to 
   write it.  And clearly, HN is my web-tech achilles heel.

thih9• 2 years ago

I find it funny that the authors are from Google, of Google Analytics, where the recommended way to opt out of tracking is to install a "do not track" browser plugin (not available on mobile).

Google has also released a browser plug-in that turns off data about a page visit being sent to Google, however, this browser extension is not available for mobile browsers.

source: https://en.wikipedia.org/wiki/Google_Analytics#Privacy

charles_f• 2 years ago

Don't care too much about do-not-stab since I deployed a pi-bulldog on my network that catches all the back alley NSRs (network stab requests). I was thinking about using SDoH (self-defense over https) or AoT (AR15 over TLS) to be protected outside my network as well, but honestly the little stabbings here and there cause sufficiently little blood to be drew that its not worth the hassle.

zombot• 2 years ago

The date in the title is wrong, it should be 2111. Most appropriately, because something as forward-thinking as this proposal cannot be expected to even come up within this century, let alone be accepted.

vrighter• 2 years ago

Well, given that we need to tell them what they are not allowed to do, vs what they they are allowed, we need some "Do-Not-X" standard convention for headers.

For example, I have my browser send all of these with each request:

Do-Not-Eat: 1

Do-Not-Insert-Into-Anus: 1

Do-Not-Do-Evil: 1

Do-Not-Chew-Loudly: 1

Do-Not-Forget-To-Bring-A-Towel: 1

Do-Not-Pee-Into-The-Wind: 1

Do-Not-Give-Me-Up: 1

Do-Not-Let-Me-Down: 1

Do-Not-Turn-Around: 1

Do-Not-Desert-Me: 1

Do-Not-Stab: 1

The last one I added just now because this article opened my eyes to this glaring omission.

narrator• 2 years ago

This will probably become less funny when everyone has a home robot that can cook for them. A robot that can handle a knife with sufficient dexterity can be a trained assassin if the owner doesn't pay the extortion demand of the malware that has infected their robot.

RFC 35140: HTTP Do-Not-Stab (2023)

Related Stories